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Claims 



What is claimed is: 
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1. 


A method for correlating request packets and reply packets during network 
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(a) 


monitoring first information associated with at least one layer of a request 




4 




packet that resides above a data link control layer thereof; 








monitoring second information associated with at least one laver of a renlv 
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packet that resides above the data link control layer thereof; 
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(c) 


correlating the request packet and the reply packet utilizing the first 




« 
o 




information and the second information* and 


S . 
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(d) 


analyzing a network based on the correlated request packet and reply packet. 


yl; 
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TTie method as recited in claim 1 wherein the first information and the 
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second information include a key. 


mi 


1 


3. 


The method as recited in claim 2, wherein the key includes information at a 




2 




remote procedure call layer. 




1 


4. 


The method as recited in claim 3, wherein the information is included in an 




2 




XID field. 




1 


5. 


The method as recited in claim 1, and further comprising storing data 




2 




associated with the request packet. 




1 


6. 


The method as recited in claim 5, wherein the data is stored in a hash table. 




1 


7. 


The method as recited in claim 6, and further comprising retrieving the data 




2 




utilizing the second information associated with the reply packet. 
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8. The method as recited in claim 1 , wherein the analysis includes decoding the 
request packet and the reply packet. 

9. The method as recited in claim 8, wherein the network is analyzed based on 
the decoded request packet and the reply packet. 

10. A computer program product for correlating request packets and reply 
packets during network analysis, comprising: 

(a) computer code for monitoring first information associated with at least one 
layer of a request packet that resides above a data link control layer thereof; 

(b) computer code for monitoring second information associated with at least 
one layer of a reply packet that resides above the data link control layer 
thereof; 

(c) computer code for correlating the request packet and the reply packet 
utilizing the first information and the second information; and 

(d) computer code for analyzing a network based on the correlated request 
packet and reply packet. 

1 1 . The computer program product as recited in claim 10, wherein the first 
information and the second information include a key. 

12. The computer program product as recited in claim 11, wherein the key 
includes information at a remote procedure call layer. 

13. The computer program product as recited in claim 12, wherein the 
information is included in an XED field. 

14. The computer program product as recited in claim 10, and further comprising 
computer code for storing data associated with the request packet. 
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1 15. The computer program product as recited in claim 14, wherein the data is 

2 stored in a hash table. 

1 16. The computer program product as recited in claim 1 5, and further comprising 

2 computer code for retrieving the data utilizing the second information 

3 associated with the reply packet. 

1 17. The computer program product as recited in claim 10, wherein the analysis 

2 includes decoding the request packet and the reply packet. 

1 18. The computer program product as recited in claim 17, wherein the network is 

2 analyzed based on the decoded request packet and the reply packet. 

1 19. A system for correlating request packets and reply packets during network 

2 analysis, comprising: 

3 (a) means for monitoring first information associated with at least one layer of a 

4 request packet that resides above a data link control layer thereof; 

5 (b) means for monitoring second information associated with at least one layer 

6 of a reply packet that resides above the data link control layer thereof; 

7 (c) means for correlating the request packet and the reply packet utilizing the 

8 first information and the second information; and 

9 (d) means for analyzing a network based on the correlated request packet and 
10 reply packet. 

1 20. A system for correlating request packets and reply packets during network 

2 analysis, comprising: 

3 (a) logic for monitoring first information associated with at least one layer of a 

4 request packet that resides above a data link control layer thereof; 

5 (b) logic for monitoring second information associated with at least one layer of 

6 a reply packet that resides above the data link control layer thereof; 
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7 (c) logic for correlating the request packet and the reply packet utilizing the first 

8 information and the second information; and 

9 (d) logic for analyzing a network based on the correlated request packet and 
10 reply packet. 

1 21. A method for correlating request packets and reply packets during network 

2 analysis, comprising: 

3 (a) reading a packet from a capture file; 

4 (b) identifying a key associated with at least one layer of the packet that resides 

5 above a data link control layer; 

O 6 (c) determining whether the packet is a request packet or a reply packet; 

% 7 (d) if the packet includes a request packet: 

O 8 (i) storing data associated with the request packet in a hash table 

£T 9 utilizing the key as an index into the hash table, and 

5 SB! 

u * 10 (ii) decoding the request packet; 

■is 

O 1 1 (e) if the packet includes a reply packet; 

J? 1 2 (i) determining whether the reply packet includes the key, 

M> 1 3 (ii) if the reply packet includes the key, retrieving the data associated 

fll 14 with the request packet from the hash table utilizing the key, 

1 5 (iii) correlating the reply packet with the request packet associated with 

16 the data, and 

1 7 (iv) decoding the reply packet; 

1 8 (f) determining whether another packet exists in the capture file; and 

1 9 (g) repeating (a)-(f) if it is determined that another packet exists in the capture 

20 file. 



NAI1P099/02.033.01 



